Posts on: Cicd

---

GitLab is an open-source end-to-end DevOps platform with built-in version control, issue tracking, code review, CI/CD, and more. For an attacker, it is a high-value target because it holds source code, CI/CD variables, deployment keys, and cloud credentials — a single GitLab compromise frequently pivots into the entire cloud estate. 2025–2026 context: GitLab has produced a steady stream of CVSS 9.0–10.0 vulnerabilities across every layer — the GraphQL engine, the SAML implementation, the Ruby regex compiler, and the CI/CD variable system. The current attack surface is dominated by unauthenticated RCE via Onigmo (CVE-2026-110264, CVSS 10.0), SAML authentication bypass (CVE-2025-25291/25292), GraphQL-based CI/CD variable disclosure (CVE-2025-9825), and personal access token leakage through logs and public repositories (CVE-2025-13611, CVE-2025-1198).

Introduction Jenkins is a continuous integration server. Jenkins runs on Tomcat port 8080 by default The default installation typically uses Jenkins’ database to store credentials and does not allow users to register an account. Jenkins if often inside internal networks Jenkins is often installed on Windows servers running as the SYSTEM account. If we can gain access via Jenkins and gain remote code execution as the SYSTEM account, we would have a foothold in Active Directory to begin enumeration of the domain environment. It is not uncommon to find Jenkins instances that do not require any authentication during an internal penetration test We can fingerprint Jenkins quickly by the telltale login page. Jenkins Script Console RCE [Authenticated] After gaining access to a Jenkins application, you can navigate to the script console: http://jenkins.test.example:8000/script The script console allows us to run arbitrary Groovy scripts within the Jenkins controller runtime. This can be abused to run operating system commands on the underlying server. Linux PoC Script: